58 lines
3.0 KiB
Markdown
58 lines
3.0 KiB
Markdown
# WP Guard — Review Checklist
|
|
|
|
Structured walk for review mode. Lead with findings, not summary. Cite file:line. Prioritize: security → silent breakage → i18n → performance.
|
|
|
|
## Contents
|
|
|
|
- Pass 1: Security sweep
|
|
- Pass 2: API and hook correctness
|
|
- Pass 3: i18n
|
|
- Pass 4: Performance
|
|
- Pass 5: Packaging hygiene
|
|
- Reporting
|
|
|
|
## Pass 1: Security sweep (must fix)
|
|
|
|
Grep-driven; check every hit:
|
|
|
|
- `echo`, `print`, `<?=`, `printf` — every variable escaped with the context-correct `esc_*`/`wp_kses`? (Rule 1)
|
|
- `$_POST`, `$_GET`, `$_REQUEST`, `$_SERVER`, `$_COOKIE` — `wp_unslash()` then sanitized? (Rule 2)
|
|
- `add_action( 'wp_ajax_`, `admin_post_`, `rest_api_init` — every state-changing handler has BOTH `current_user_can()` and a nonce check / real `permission_callback`? (Rule 3)
|
|
- `$wpdb->` — every variable behind `prepare()` placeholders? `esc_like()` for LIKE? (Rule 4)
|
|
- `$_FILES` — handled via `wp_handle_upload()` with type allowlist?
|
|
- Secrets: API keys hardcoded? Logged? In autoloaded options when they belong in constants/env?
|
|
|
|
## Pass 2: API and hook correctness (should fix)
|
|
|
|
- Every hooked hook and called function exists in supported WP/plugin versions? (Rule 6 — hallucinated hooks fail silently)
|
|
- Hook timing right? (No front-end work on admin hooks, no early queries, no `init`-heavy work per request)
|
|
- Core API replacements: curl, raw `<script>` echoes, manual cron loops, direct file ops? (Rule 5)
|
|
- Prefixes on every public name: functions, options, transients, meta keys, handles, AJAX actions? (Rule 7)
|
|
- `ABSPATH` guard present in working files? (Rule 8)
|
|
- `wp_safe_redirect()` + `exit` after state changes?
|
|
|
|
## Pass 3: i18n (should fix; blocking on multilingual projects)
|
|
|
|
- User-facing strings without wrappers? Wrong/non-literal text domain? (Rule 9)
|
|
- Placeholders without translator comments? Plural logic without `_n()`?
|
|
- Concatenated sentence fragments?
|
|
- Stored user-facing strings (options/meta) that multilingual plugins can't see? (see [i18n.md](i18n.md))
|
|
- Raw `date()`/`number_format()` for display?
|
|
|
|
## Pass 4: Performance (worth noting; blocking on every-request paths)
|
|
|
|
- `posts_per_page => -1`, `query_posts()`, unbounded `get_users()`/`get_terms()`? (Rule 10)
|
|
- Queries or `get_post_meta()` inside loops without cache priming?
|
|
- Remote calls without transient/object caching? (Rule 11)
|
|
- Large options autoloading? Unconditional asset enqueues?
|
|
|
|
## Pass 5: Packaging hygiene
|
|
|
|
- WooCommerce code in scope → hand off to woo-guard when it is installed; otherwise apply WooCommerce's HPOS, CRUD, checkout, and money rules from its developer documentation.
|
|
- Activation/deactivation/uninstall: scheduled events cleared, transients cleaned, uninstall removes its data?
|
|
- Direct entry files, readme version mismatches, debug code (`error_log`, `var_dump`) left in?
|
|
|
|
## Reporting
|
|
|
|
Use the SKILL.md reporting format. Lead with the security findings and an overall verdict (merge / fix first / do not merge). End with at most three positives worth keeping — reviewers who only list faults get ignored.
|